The System File Monitor detects attempts to overwrite any system file that is designated as protected. When an attempt is made to change such a file, Windows Me does the following:
1. Stores a copy of the original file.
2. Checks a database of catalog files to determine whether the new version of the file is a valid replacement.
3. If the new version of the file is a valid replacement, Windows Me allows the new file to replace the old version. Otherwise, Windows Me restores the original version of the file silently, without alerting the end user.
The stored copy of the original file is deleted soon after the file is either replaced or restored.
File corruption does not trigger SFP. If a protected system file becomes corrupted, the end user can replace the corrupted version of the file with a valid copy from the distribution media.